CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

www/node 24.22.1

V8 JavaScript for client and server (meta port)

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 24.21.0_3, update to 24.22.1 not built yet
Upstream
up to date
Last update
to 24.22.1 · ba74741313
Quarterly
2026Q4: 24.21.0_3 · last MFH 5355d058d8
Formerly
www/node7 until 2016-12-07, www/iojs until 2015-09-23
WWW
https://nodejs.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install node
installs 24.21.0_3 from latest; from quarterly (2026Q4) 24.21.0_3
Port
# cd /usr/ports/www/node && make install clean
Size
1.2 KiB download · 243 B installed
Depends on
www/node24 24.21.0_3
License
NA

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 1624.21.0_324.21.0_3–
FreeBSD 1524.21.0_324.21.0_3–
FreeBSD 1424.21.0_324.21.0_324.21.0_3

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 1524.21.0_324.21.0_3–
FreeBSD 1424.21.0_324.21.0_324.21.0_3

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (0)

The CVE record lists the packaged version 24.21.0_3 as affected, and no VuXML entry names the CVE. What does this mean?

None.

VuXML only (1)

Listed in VuXML, the packaged version 24.21.0_3 is still in the affected range; pkg audit reports it. What does this mean?

Fixed (30)

Show 30 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (436)

Bradley T. Hughes (bhughes) · 11.10.0
www/node: Update 11.9.0 -> 11.10.0

https://nodejs.org/en/blog/release/v11.10.0/

Sponsored by:	Miles AS
79f75df02f
Bradley T. Hughes (bhughes) · 11.9.0
www/node*: fix build on non-amd64/-i386 when BUNDLED_SSL is unset

The --openssl-no-asm configure option should only be set
when BUNDLED_SSL is enabled.

PR:		235311
Reported by:	jbeich
Sponsored by:	Miles AS
b7af5e6407
Bradley T. Hughes (bhughes) · 11.9.0
www/node: Update 11.8.0 -> 11.9.0

Update patches and pkg-plist for deps/openssl/**/* after upstream
pdated to OpenSSL 1.1.1a and refresh existing patches with
`make makepatch`.

https://nodejs.org/en/blog/release/v11.9.0/

Sponsored by:	Miles AS
6be93585e9
Bradley T. Hughes (bhughes) · 11.8.0
www/node: Update 11.7.0_1 -> 11.8.0

https://nodejs.org/en/blog/release/v11.8.0/

Sponsored by:	Miles AS
9cc3cafe06
Bradley T. Hughes (bhughes) · 11.7.0_1
www/node: disable BUNDLED_SSL by default on FreeBSD >=12

Change the default options on FreeBSD >=12 since OpenSSL 1.1.1 is
available in the base system. Bump PORTREVISION due to the change in
defaults.

While here, convert the port to use BROKEN_SSL, taking care to set
BROKEN_SSL+=base when appropriate.

PR:		234762
Reported by:	amdmi3
Sponsored by:	Miles AS
50aae0ccfe
Bradley T. Hughes (bhughes) · 11.7.0
www/node: Update 11.6.0 -> 11.7.0

https://nodejs.org/en/blog/release/v11.7.0/

Sponsored by:	Miles AS
f9c4644cab
Bradley T. Hughes (bhughes) · 11.6.0
www/node: Update 11.3.0_1 -> 11.6.0

https://nodejs.org/en/blog/release/v11.4.0/
https://nodejs.org/en/blog/release/v11.5.0/
https://nodejs.org/en/blog/release/v11.6.0/

Sponsored by:	Miles AS
5aee51a51b
Gerald Pfeifer (gerald) · 11.3.0_1
Bump PORTREVISION for ports depending on the canonical version of GCC defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t GCC 8.2 under most circumstances.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.

PR:		231590
a9f015d155
Antoine Brodin (antoine) · 11.3.0
Spell CHOSEN_COMPILER_TYPE correctly

PR:		199098
With hat:	portmgr
c06409c76b
Bradley T. Hughes (bhughes) · 11.3.0
www/node: Update 11.2.0 -> 11.3.0

This is a security release that addresses multiple vulnerabilities. Users
are recommended to upgrade as soon as possible.

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
https://nodejs.org/en/blog/release/v11.3.0/

MFH:		2018Q4
Security:	2a86f45a-fc3c-11e8-a414-00155d006b02
Sponsored by:	Miles AS
b97e90ea6c
Bradley T. Hughes (bhughes) · 11.2.0
www/node: Update 11.1.0 -> 11.2.0

https://nodejs.org/en/blog/release/v11.2.0/

Sponsored by:	Miles AS
7cac055c2f
Mathieu Arnold (mat) · 11.1.0
security/openssl-devel was removed, but there is a security/openssl111 now.
35326f1a97
Bradley T. Hughes (bhughes) · 11.1.0
www/node: remove BROKEN for FreeBSD 10

Sponsored by:	Miles AS
017dd8db31
Bradley T. Hughes (bhughes) · 11.1.0
www/node: Update 11.0.0 -> 11.1.0

https://nodejs.org/en/blog/release/v11.1.0/

Sponsored by:	Miles AS
a2eb8e33b4
Rene Ladan (rene) · 11.0.0
Remove compatibility code for FreeBSD < 11.2 from all ports.

Simplify some ports where DragonFlyBSD no longer needs to be special-cased.
Submitted by:	rene
Reviewed by:	bapt, jbeich
Differential Revision:	https://reviews.freebsd.org/D17724
8a502cb2d4
Bradley T. Hughes (bhughes) · 11.0.0
www/node: Update 10.12.0_1 -> 11.0.0

Update to the latest major release of Node.js. Upstream has dropped
support for FreeBSD 10.x, so mark the port as BROKEN on FreeBSD 10.
Regenerate patches with `make makepatch`.

https://nodejs.org/en/blog/release/v11.0.0/

Sponsored by:	Miles AS
3eebc51b4e
Bradley T. Hughes (bhughes) · 10.12.0_1
www/node10: copy from www/node, update 10.12.0_1 -> 10.13.0 (LTS)

Create a new port for the latest Node.js 10.13.0 LTS release. Update
CONFLICTS for the existing Node.js ports to include the new node10 port
and remove non-existent ports.

https://nodejs.org/en/blog/release/v10.13.0/

Sponsored by:	Miles AS
be15e8b611
Jan Beich (jbeich) · 10.12.0_1
devel/icu: update to 63.1

Changes:	http://site.icu-project.org/download/63
ABI:		https://abi-laboratory.pro/tracker/timeline/icu4c/
PR:		232300
Exp-run by:	antoine
91f9922c6f
Bradley T. Hughes (bhughes) · 10.12.0
www/node: Update 10.11.0 -> 10.12.0

https://nodejs.org/en/blog/release/v10.12.0/

Sponsored by:	Miles AS
ab674c79eb
Bradley T. Hughes (bhughes) · 10.11.0
www/node: Update 10.10.0 -> 10.11.0

https://nodejs.org/en/blog/release/v10.11.0/

Sponsored by:	Miles AS
4886cc56d7
Bradley T. Hughes (bhughes) · 10.10.0
www/node: Update 10.9.0_1 -> 10.10.0

https://nodejs.org/en/blog/release/v10.10.0/

Sponsored by:	Miles AS
055df62679
Bradley T. Hughes (bhughes) · 10.9.0_1
www/node: add dependency on www/libnghttp2

... instead of using the bundled version. Bump PORTREVISION due to the
new dependency.

Sponsored by:	Miles AS
f62c4309b4
Bradley T. Hughes (bhughes) · 10.9.0
www/node: Update 10.7.0_1 -> 10.9.0

This is a security release addressing multiple vulnerabilities. Users
are recommended to upgrade as soon as possible.

https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/
https://nodejs.org/en/blog/release/v10.9.0/

While here, refresh patches with `make makepatch`

MFH:		2018Q3
Security:	0904e81f-a89d-11e8-afbb-bc5ff4f77b71
Sponsored by:	Miles AS
5c22e647dc
Sunpoet Po-Chuan Hsieh (sunpoet) · 10.7.0_1
Update WWW

Approved by:	portmgr (blanket)
fa486efc77
Gerald Pfeifer (gerald) · 10.7.0_1
Bump PORTREVISION for ports depending on the canonical version of GCC in the ports tree (via Mk/bsd.default-versions.mk and lang/gcc) which has now moved from GCC 6 to GCC 7 by default.

This includes ports
 - featuring USE_GCC=yes or USE_GCC=any,
 - featuring USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and those
 - with USES=compiler specifying one of openmp, nestedfct, c11, c++0x,
   c++11-lib, c++11-lang, c++14-lang, c++17-lang, or gcc-c++11-lib.

PR:		222542
09f9633cb6
Bradley T. Hughes (bhughes) · 10.7.0
www/node: Update 10.6.0 -> 10.7.0

https://nodejs.org/en/blog/release/v10.7.0/

Sponsored by:	Miles AS
2103b10e0e
Bradley T. Hughes (bhughes) · 10.6.0
www/node: Update 10.5.0 -> 10.6.0

https://nodejs.org/en/blog/release/v10.6.0/

Sponsored by:	Miles AS
292325fd47
Jan Beich (jbeich) · 10.5.0_1
devel/icu: update to 62.1

Changes:	http://site.icu-project.org/download/62
ABI:		https://abi-laboratory.pro/tracker/timeline/icu4c/
PR:		229359
Exp-run by:	antoine (only 10.4)
3beb732dad
Bradley T. Hughes (bhughes) · 10.5.0
www/node: Update 10.4.1 -> 10.5.0

https://nodejs.org/en/blog/release/v10.5.0/
7c67b2dffc
Bradley T. Hughes (bhughes) · 10.4.1
www/node: Update 10.4.0 -> 10.4.1

Update to the latest security release, fixing CVE-2018-7161,
CVE-2018-7162, CVE-2018-7164, and CVE-2018-1000168.

https://nodejs.org/en/blog/release/v10.4.1/
https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/

MFH:		2018Q2
Security:	45b8e2eb-7056-11e8-8fab-63ca6e0e13a2
Sponsored by:	Miles AS
c8ca6acb64
Bradley T. Hughes (bhughes) · 10.4.0
www/node: Update 10.3.0 -> 10.4.0

https://nodejs.org/en/blog/release/v10.4.0/

Remove files/patch-deps_v8_src_base_cpu.cc, which has been applied
upstream and is no longer necessary (as reported in PR 228779). Other
patches have been refreshed as needed with `make makepatch`.

PR:		228779
Reported by:	Sylvain Garrigues <sylvain@sylvaingarrigues.com>
Sponsored by:	Miles AS
309474009e
Mark Linimon (linimon) · 10.3.0
Mark as broken on powerpc64.

Approved by:	portmgr (tier-2 blanket)
1255064e1f
Bradley T. Hughes (bhughes) · 10.3.0
www/node: Update 10.1.0_1 -> 10.3.0

https://nodejs.org/en/blog/release/v10.2.0/
https://nodejs.org/en/blog/release/v10.2.1/
https://nodejs.org/en/blog/release/v10.3.0/

Sponsored by:	Miles AS
3694fef040
Bradley T. Hughes (bhughes) · 10.1.0_1
www/node: fix build on i386

Add patch files missing from r469781, which ensure that the Node.js
build on i386 falls back to the linux-elf OpenSSL config.

PR:		228135
Reported by:	Marcin Cieslak <saper@saper.info>
864c3d97dd
Bradley T. Hughes (bhughes) · 10.1.0_1
www/node: fix SSL/TLS on i386

The upgrade to v10.0.0 included significant changes to the OpenSSL
dependency in Node.js, in particular how the build was configured.
Upstream does not include a BSD-x86 config anymore, so the www/node port
ended up using the BSD-x86_64 no-asm config for all builds except x86_64
(which used the asm optimized config). This was a mistake, causing all
32-bit archs to build OpenSSL configured for a 64-bit architecture, and
it causes problems with SSL/TLS as described in PR 228135.

Change the build config to not use BSD-x86_64 no-asm for 32-bit i386 and
arm builds, falling back to the generic linux-elf configuration instead.
Patches remove Linux specific libraries (-ldl) and keep the CFLAGS the
same as the BSD config.

PR:             228135
Reported by:    Marcin Cie\xc5\x9blak <saper@saper.info>
349bf96160
Bradley T. Hughes (bhughes) · 10.1.0
www/node: Update 10.0.0 -> 10.1.0

https://nodejs.org/en/blog/release/v10.1.0/
29a3dfca0a
Bradley T. Hughes (bhughes) · 10.0.0
www/node: Update 9.11.1_1 -> 10.0.0

Update to the latest major release of Node.js. This release includes
many significant changes, both to Node.js itself and the FreeBSD port.

https://nodejs.org/en/blog/release/v10.0.0/

In particular, Node.js now requires OpenSSL 1.1.0h, so the BUNDLED_SSL
option is enabled by default. It is still possible to disable this
option when using security/openssl-devel (which is currently at 1.1.0h).
Multiple patches are required to get Node.js building with the bundled
OpenSSL library. Only amd64 builds get optimized assembler; all other
archs use non-asm implementations.
1feb29bc1f
Jan Beich (jbeich) · 9.11.1_1
devel/icu: update to 61.1

Changes:	http://site.icu-project.org/download/61
ABI:		https://abi-laboratory.pro/tracker/timeline/icu4c/
PR:		227042
Exp-run by:	antoine
MFH:		2018Q2 (required by Firefox 61)
ae60358af5
Bradley T. Hughes (bhughes) · 9.11.1
www/node: Update 9.10.1 -> 9.11.1

https://nodejs.org/en/blog/release/v9.11.0/
https://nodejs.org/en/blog/release/v9.11.1/
c8e3e31ea7
Bradley T. Hughes (bhughes) · 9.10.1
www/node: Update 9.10.0 -> 9.10.1

No changes from the previous verison. This release ensures that the
hosted binaries from the Node.js project adhere to the platform support
contract, which does not apply to the FreeBSD port and packages.

MFH:		2018Q2
b9f8225169
Bradley T. Hughes (bhughes) · 9.10.0
www/node: Update 9.9.0 -> 9.10.0

This is a security release addressing multiple vulnerabilities. Users
are recommended to upgrade as soon as possible.

https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/
https://nodejs.org/en/blog/release/v9.10.0/

MFH:		2018Q1
Security:	5a9bbb6e-32d3-11e8-a769-6daaba161086
8672cb3f77
Bradley T. Hughes (bhughes) · 9.9.0
www/node: Update 9.8.0 -> 9.9.0

https://nodejs.org/en/blog/release/v9.9.0/
6a5b7c255f
Bradley T. Hughes (bhughes) · 9.8.0
www/node: Update 9.7.1 -> 9.8.0

https://nodejs.org/en/blog/release/v9.8.0/
65a4a55f21
Bradley T. Hughes (bhughes) · 9.7.1
www/node: Update 9.7.0 -> 9.7.1

There are not changes in the release. A new version was published due to
a bad node-v9.7.0.pkg (macOS installer) file that was published to
nodejs.org in the previous release.

https://nodejs.org/en/blog/release/v9.7.1/
44516d399d
Bradley T. Hughes (bhughes) · 9.7.0
www/node: Update 9.6.1 -> 9.7.0

https://nodejs.org/en/blog/release/v9.7.0/
e23f0d9fd5
Bradley T. Hughes (bhughes) · 9.6.1
www/node: Update 9.5.0 -> 9.6.1

https://nodejs.org/en/blog/release/v9.6.0/
https://nodejs.org/en/blog/release/v9.6.1/
e21c83a083
Antoine Brodin (antoine) · 9.5.0
Reduce dependency on the python2 metaport

PR:		225752
Submitted by:	Yasuhiro KIMURA
f7455240e3
Justin Hibbits (jhibbits) · 9.5.0
Mark www/node as buildable by powerpc64

Summary:
As of node 9.3.0, a bug was fixed preventing builds with gcc.  As this has
not been tested on mips, and fails on powerpcspe, only add powerpc64 to the
ONLY_FOR_ARCHS list.

Test Plan: Built for powerpc64

Reviewed By: bhughes
Differential Revision: https://reviews.freebsd.org/D13880
d1d976c6d9
Bradley T. Hughes (bhughes) · 9.5.0
www/node,www/node8,www/node6: disable dtrace usdt on armv[67]

Disable the DTRACE option by default on armv[67] since Node.js fails to
build on armv[67] with the following error:

dt_modtext:/usr/src/cddl/contrib/opensolaris/lib/libdtrace/common/dt_link.c(820): arm not implemented

PR:		224271
Submitted by:	mikael.urankar@gmail.com
07f8f07505
Bradley T. Hughes (bhughes) · 9.5.0
www/node: Update 9.4.0 -> 9.5.0

https://nodejs.org/en/blog/release/v9.5.0/
fde1bf68f1